CVE-2026-16993: WooCommerce Info Disclosure Vulnerability

CVE-2026-16993 Overview

CVE-2026-16993 affects the DHL Shipping Germany for WooCommerce WordPress plugin in versions prior to 4.0.1. The plugin stores generated shipping labels in a directory protected only by an Apache .htaccess file. Web servers that do not honor .htaccess directives, such as nginx, ignore this control entirely. An unauthenticated remote attacker can request predictable filenames and download stored shipping labels. Each label exposes a customer's full name and postal address, resulting in information disclosure [CWE-200].

Critical Impact
Unauthenticated attackers can retrieve customer shipping labels containing names and postal addresses from affected WordPress sites running on nginx or other servers that ignore .htaccess.

Affected Products

DHL Shipping Germany for WooCommerce WordPress plugin versions before 4.0.1
WordPress installations served by web servers that do not honor .htaccess (for example, nginx)
WooCommerce stores using the affected plugin to generate DHL shipping labels

Discovery Timeline

2026-08-05 - CVE-2026-16993 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-16993

Vulnerability Analysis

The plugin generates PDF shipping labels and stores them within the WordPress uploads hierarchy. To prevent public access, the plugin drops an Apache .htaccess file into the storage directory that denies HTTP requests. This approach ties access control to a single web server's configuration format rather than enforcing authorization at the application layer.

On nginx, LiteSpeed in certain configurations, Caddy, and other servers that ignore .htaccess, the deny rules are never evaluated. The label directory becomes reachable over HTTP. Because filenames follow a predictable pattern derived from order metadata, an attacker can enumerate valid label URLs and retrieve the PDFs without authentication.

The disclosed labels contain personally identifiable information (PII), including the customer's full name and postal address. This creates downstream risk of targeted phishing, physical mail fraud, and regulatory exposure under GDPR.

Root Cause

The root cause is reliance on server-specific access control instead of server-independent authorization. The plugin does not proxy label downloads through a PHP handler that verifies session identity, capability, or a signed token. It also does not randomize filenames with sufficient entropy to prevent enumeration.

Attack Vector

Exploitation requires network access to the target site and knowledge of the label URL pattern. An unauthenticated attacker constructs candidate URLs pointing to the plugin's label storage directory and issues HTTP GET requests. On vulnerable server configurations, the response returns the PDF label content. The attacker parses the PDF to extract the recipient's name and address. See the WPScan Vulnerability Report for additional technical detail.

Detection Methods for CVE-2026-16993

Indicators of Compromise

Unauthenticated HTTP GET requests to the DHL Shipping Germany plugin's label storage directory under wp-content/uploads/
Sequential or scripted access patterns targeting predictable PDF filenames in the label directory
HTTP 200 responses returning application/pdf content from label paths to clients without authenticated session cookies

Detection Strategies

Review web server access logs for external requests to the plugin's upload subdirectory and flag any that return PDF content
Compare responses served by nginx (or non-Apache servers) against the intent expressed in the plugin's shipped .htaccess file to identify bypassed controls
Monitor for user-agent patterns and IP addresses generating high request volumes against wp-content/uploads/ paths

Monitoring Recommendations

Centralize WordPress and reverse-proxy access logs in a SIEM and alert on direct downloads of shipping label PDFs
Establish a baseline of normal access to the uploads directory and alert on deviations, particularly unauthenticated PDF retrievals
Track plugin version inventory across all WordPress instances to identify hosts still running versions before 4.0.1

How to Mitigate CVE-2026-16993

Immediate Actions Required

Upgrade the DHL Shipping Germany for WooCommerce plugin to version 4.0.1 or later on all WordPress instances
Audit the plugin's label storage directory and confirm that direct HTTP access is denied at the web server level
Rotate or purge historical label PDFs that may have been exposed while the vulnerable configuration was live

Patch Information

Update to DHL Shipping Germany for WooCommerce version 4.0.1 or later. The fix removes reliance on .htaccess as the sole access control. Refer to the WPScan Vulnerability Report for advisory references.

Workarounds

Add an explicit nginx location block that denies public access to the plugin's label storage directory until the plugin can be updated
Move the label storage directory outside the web root and serve labels through an authenticated PHP handler
Restrict access to wp-content/uploads/ PDF files behind authentication using a WordPress security plugin or reverse-proxy rules

bash

# Example nginx configuration to block direct access to DHL label storage
location ~* /wp-content/uploads/wc-dhl-label-tracking/ {
    deny all;
    return 403;
}